_call


_call is a query directive used to sort the result set.

Overview

_call is a query directive used to execute playbook and return the original stack of data in the Search tab. _call directive is used to allow blocking and non-blocking calls to playbook entities. Here, playbook is a new entity type in DNIF which is used to store and allow direct console execution of queries.

Example

Take a look at the example given below:

_fetch * from event where $Duration=2d limit 1
>>_call bug_testing test_playbook123

Here:

1. The _fetch query directive retrieves all fields for each event in the event index where $Duration is 2 days. It is then limited to 1 row. The output is as shown below:

resultset of the fetch query function

2. In the pipelined query, the _call directive uses the package name bug_testing and playbook name test_playbook123. The output is as shown below:

resultset of the sort query function

The _call directive allows you to:

  • Execute playbook which is having status as EXECUTABLE.
  • Blocking and non-blocking calls to playbook entities. Entities include widgets, workbook, report, module, template email, etc.
  • The execution of the playbook returns the original stack of data as the result.
  • It does not return the result of the query execution mentioned inside the playbook.

SYNTAX

The generic syntax of the _call directive is as shown below:

_call <package_slug> <playbook_slug>

Here,

package_slug: slug name of the package

playbook_slug: slug name of the playbook

Here,

slug_name means alias name which is used in DNIF Query Language (DQL).

NOTE: The _call directive is available only on latest DNIF version 8.7.0